The Harness as the Only Mutable Surface: Compliance-Bounded Self-Evolution of LLM Agents in Credit Pipelines, with a Measured Admission Gate

Title: The Harness as the Only Mutable Surface: Compliance-Bounded Self-Evolution of LLM Agents in Credit Pipelines, with a Measured Admission Gate

标题：作为唯一可变表面的工具框架：信贷流水线中受合规约束的 LLM 智能体自我进化及测量准入机制

Abstract: Self-improving LLM agents can adapt a credit pipeline to a changed rule, but an agent that rewrites itself destroys the artefact a supervisor reviews: a named change, a recorded test, an approval. We argue that self-evolution is reviewable only if it is confined to the runtime harness (instruction text, tool-call logic and primitive composition) while model weights stay fixed, so that every adaptation is a diff with a cause and a test attached.

摘要：能够自我改进的 LLM 智能体可以使信贷流水线适应规则的变化，但如果智能体自行重写，就会破坏监管者所审查的产物：即命名的变更、记录的测试和审批。我们认为，只有将自我进化限制在运行时工具框架（指令文本、工具调用逻辑和原语组合）内，同时保持模型权重不变，自我进化才是可审查的，这样每一次适应都是带有原因和测试的差异（diff）。

We give a dual-loop engine built on that bound, with one admission gate that writes a hash-chained record before deployment, and we measure the gate in simulation, with a simulated agent and a seeded-search proposer rather than language models. Across three families of supervisory re-interpretation at three severities, 10 seeds each, the gated loop admitted 144 of 7,449 candidate changes, none of which worsened error on held-out history, and restored the false-positive rate to the oracle level without raising missed flags in every low- and mid-severity cell.

我们提供了一个基于该约束构建的双循环引擎，其中包含一个在部署前写入哈希链记录的准入闸门。我们通过模拟对该闸门进行了测量，使用的是模拟智能体和种子搜索提议者，而非语言模型。在三个严重程度、每个包含 10 个种子的三类监管重新解释实验中，带闸门的循环从 7,449 个候选变更中准入了 144 个，其中没有一个导致留存历史数据上的错误恶化，并且在所有低严重性和中严重性单元中，将误报率恢复到了预言机水平，且未增加漏报。

With the gate replaced by the check an unbounded system applies (fewer errors visible in recent traces), the same loops admitted 309 harmful changes and left missed flags above 10% in 49 of 90 runs: false positives fell because the screen was loosened. Evaluated on pre-shift labels, the gate rejected every candidate, so a re-interpretation must be encoded as a rule that relabels history.

当用无界系统所应用的检查（即近期追踪中可见的错误较少）替换该闸门时，相同的循环准入了 309 个有害变更，并在 90 次运行中有 49 次的漏报率超过 10%：误报率下降是因为筛选标准放宽了。在预偏移标签上进行评估时，该闸门拒绝了所有候选者，因此重新解释必须被编码为一种重新标记历史的规则。

Parametric and scope shifts were repaired locally, a structural one only by primitive replacement; at the highest structural severity the gate’s fixed tolerance blocked the correct replacement in half the seeds. We map the mechanisms to the EU AI Act’s provisions for high-risk credit scoring and note that the April 2026 US model-risk guidance excludes agentic AI from its scope.

参数和范围偏移在局部得到了修复，而结构性偏移只能通过原语替换来修复；在最高结构严重性下，闸门的固定容差在半数种子中阻止了正确的替换。我们将这些机制映射到欧盟《人工智能法案》关于高风险信用评分的规定，并指出 2026 年 4 月的美国模型风险指南将智能体 AI 排除在其范围之外。